xhci: Fix incorrect tracking of free space on transfer rings
authorMathias Nyman <mathias.nyman@linux.intel.com>
Mon, 15 May 2023 13:40:59 +0000 (16:40 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 16 May 2023 14:57:49 +0000 (16:57 +0200)
commitfe82f16aafdaf8002281d3b9524291d4a4a28460
tree602d412e45886242ae42e159c5845f003befce32
parent2a821fc3136d5d99dcb9de152be8a052ca27d870
xhci: Fix incorrect tracking of free space on transfer rings

This incorrect tracking caused unnecessary ring expansion in some
usecases which over days of use consume a lot of memory.

xhci driver tries to keep track of free transfer blocks (TRBs) on the
ring buffer, but failed to add back some cancelled transfers that were
turned into no-op operations instead of just moving past them.

This can happen if there are several queued pending transfers which
then are cancelled in reverse order.

Solve this by counting the numer of steps we move the dequeue pointer
once we complete a transfer, and add it to the number of free trbs
instead of just adding the trb number of the current transfer.
This way we ensure we count the no-op trbs on the way as well.

Fixes: 55f6153d8cc8 ("xhci: remove extra loop in interrupt context")
Cc: stable@vger.kernel.org
Reported-by: Miller Hunter <MillerH@hearthnhome.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217242
Tested-by: Miller Hunter <MillerH@hearthnhome.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230515134059.161110-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/host/xhci-ring.c